This is a guide for users to use the security operating center portal of OpenSASE/XDR.

• Email Address or ID: A field where users enter their registered email address or ID (e.g., "Enter your registered email address or ID").
• Password: A field for entering the user’s password (e.g., "Enter your password"), with a visibility toggle icon to show or hide the password.

• Top-right corner of the screen. 
  By clicking the "⋮" (three dots) icon in the top-right corner, users can access a detailed menu related to user authentication. This menu provides additional options for managing login settings or troubleshooting access issues.

• QR Code: A QR code is displayed for users to scan with a device that has a registered PassKey, enabling secure verification.

• Verify with Phone Number Button: An alternative "Verify with Phone Number" button is provided for users whose devices do not have a registered PassKey.

• QR Code: A QR code is displayed for users to scan with a device that has a registered PassKey, enabling secure verification prior to password reset.

• Verify with Phone Number Button: An alternative "Verify with Phone Number" button is provided for users whose devices do not have a registered PassKey.

• PassKey-verified phone number: Displays a pre-filled, non-editable phone number associated with the PassKey.
• Email Address: A field to enter the user’s email address (e.g., "markov01@markov.com"), with a "Check Availability" button to verify if the email is available (status: "Email address is available for use").
• User Name: A field to enter the user’s name

• Purpose: Provides a centralized view of security and network event data, enabling users to monitor and manage incidents effectively.
• Data Sources: Integrates information from multiple origins, including agents, agentless systems, and external feeds.
• Key Information: Displays summaries of event counts, severity levels, and current statuses to facilitate quick decision-making.

• Agency monitoring
• System monitoring

• Agency List: A comprehensive roster of agencies within the selected region.
• Network Status (CPE): Provides the current operational status of the Customer Premises Equipment for eacßh agency.
• Security Status (SDP): Details the security posture, including Software-Defined Perimeter (SDP) metrics, for each agency.

• Region-Based Counts: Displays the total number of agencies in each region.
• CPE Status Info: Offers insights into the operational status of CPE devices across the agencies

• Type: Indicates the category of the event (e.g., sdp-audit, Security).
• Event Name: Specifies the event description (e.g., NdpPerformance, Hardware State Check, ProcessCheck, or security-related messages like [JAMES] Blocked access to www…).
• Level: Denotes the severity of the event, categorized as Info, Minor, or Critical, Block.
• Time: Shows the timestamp of the event in the format MM/DD HH:MM:SS.milliseconds (e.g., 03/30 16:13:00.025).

• sdp-audit events such as NdpPerformance and Hardware State Check with Info level.
• Security events like [JAMES] Access blocked: Rans… with Critical level or [JAMES] Android OS version is to… with High level.

• Filters and Search:
  • Customer and Asset Selection: Dropdown menus at the top (e.g., "Select a customer," "Select an asset") to filter cases by specific customers or assets.
  • Date Range: A date picker to filter cases within a specific time period (e.g., 2024/09/30 - 2024/10/30).
  • Advanced Search: A button on the right to access advanced search options for more granular filtering.
• Case Summary:
  • Displays the total number of cases (e.g., 279 cases) and the total results (e.g., 2,193 cases) for the selected filters.
• Case Table:
  • A table listing cases with columns such as:
    • Event Type: Type of event (e.g., Raw Packet).
    • Source Asset: Source of the event.
    • Destination Asset: Destination of the event.
    • Rule: Applied rule.
    • Source IP: Source IP address.
    • Destination Port: Destination port.
    • Time: Timestamp of the event.
    • Raw Packet: A column with a clickable icon to view raw packet details (e.g., BSX525D9252F...).
• Notification Settings:
  • A "Notification Settings" button at the top-right corner to configure alert preferences.

• Dropdown Menu: Displays a list of available customers (e.g., SK Telecom, Samsung Electronics, KT&G, Ericsson, Coca Cola, General Electric, BMW).
• Action: Click the "Select a customer" dropdown to choose a customer, filtering the case list to show only cases related to the selected customer.

• Each customer is represented, indicating secure separation of data in the multi-tenant environment.
• The associated assets for the selected customer are displayed.

• Case Information: The default tab, showing detailed case data.
• Case Management: A secondary tab for managing the case.

• Event Type: The type of event
• Asset Type: The type of asset involved
• Asset No.: The asset identifier
• Timestamp: The date and time of the event
• System IP: The system IP address
• Origin Country: The country of origin
• Origin IP: The originating IP address
• Origin Port: The originating port
• Destination Country: The destination country
• Destination IP: The destination IP address (
• Destination Port: The destination port 
• Remote IP: The remote IP address

• A table at the bottom listing related events, with columns including:
  • Event Type: Type of related event
  • Asset Type: Type of asset involved
  • Asset No.: Asset identifier
  • Timestamp: Date and time of the related event
  • System IP: System IP address

• Assignee: The user assigned to handle the case (e.g., Bryan Ga).
• Event Type: The type of event (e.g., Traffic).
• Asset Type: The type of asset involved (e.g., Juniper).
• Asset No.: The asset identifier (e.g., 38697).
• Timestamp: The date and time the event occurred (e.g., 2024-09-30 10:57:59+09:00).
• System IP: The system IP address (e.g., 1.1.1.1).
• Severity Level: The severity of the case (e.g., Critical).
• Threat Classification: The threat level or classification (e.g., 9)

• Evaluate the Case: Users are prompted to "Evaluate the case details and associated events to verify if it’s a legitimate threat incident and handle it accordingly."
• Event Information Access: Users can find detailed event information for the open case and related events in the "Case Information" tab of the Case Details popup.
• Check for Positive: Users must determine the legitimacy of the threat by selecting one of two options:
  • Confirmed as True Positive: Indicates the incident is a confirmed threat.
  • Confirmed as False Positive: Indicates the incident is not a threat (e.g., a false alarm).

• After completing the evaluation and selecting the appropriate "Check for Positive" option, users click the "Save Step" button to record their findings and proceed to the next step in the Case Management process.

• Priority Evaluation: Users are informed that "Priority is evaluated based on the severity and impact of the event."
• Severity Level Selection: Users can select the severity level of the case from the following options:
  • Critical: For incidents with severe impact requiring immediate action.
  • High: For incidents with significant impact needing prompt attention.
  • Moderate: For incidents with moderate impact that can be addressed in a standard timeframe.
  • Low: For incidents with minimal impact that can be handled with lower urgency.

• After selecting the appropriate severity level (e.g., Critical, High, Moderate, or Low), users click the "Save Step" button to record the prioritization and proceed to the next step in the Case Management process.

• Analyze the Threat: Users are prompted to "Analyze the root cause of the threat and identify the affected assets and scope."
• Further Analysis: If needed, users are advised to "conduct further analysis on related logs and events" to gain deeper insights into the incident.
• Document Findings: Users are required to "describe the analysis details thoroughly in the text-area below for reporting purposes." A text editor is provided to input detailed notes, with formatting options such as bold, italic, underline, alignment, lists, links, images, and emojis.

• Users enter their analysis details in the text area.
• After completing the analysis and documenting the findings, users click the "Save Step" button to record their work and proceed to the next step in the Case Management process.

• Containment Measures: Users are advised to "perform containment measures or isolate network segments to minimize impact" if the attack is ongoing.
• Isolation and Blocking: Users are instructed to "temporarily isolate affected systems or apply security policies to block the attack, if needed."
• Document Actions: Users are required to "describe the analysis details thoroughly in the text-area below for reporting purposes." A text editor is provided to input detailed notes, with formatting options such as bold, italic, underline, alignment, lists, links, images, and emojis.

• Users document the containment and mitigation actions taken in the text area.
• After completing the actions and documenting the details, users click the "Save Step" button to record their work and proceed to the next step in the Case Management process.

• Resolve and Restore: Users are instructed to "resolve the root cause and restore systems or networks to their normal operational state."
• Apply Security Measures: Users are advised to "apply security patches and remove malware from infected assets" to secure the environment.
• Document Actions: Users are required to "describe the analysis details thoroughly in the text-area below for reporting purposes." A text editor is provided to input detailed notes, with formatting options such as bold, italic, underline, alignment, lists, links, images, and emojis.

• Users document the recovery and remediation actions taken in the text area.
• After completing the actions and documenting the details, users click the "Save Step" button to record their work and proceed to the next step in the Case Management process.

• Update Case Status: Users are instructed to "refer to the case status and use the button below to update it to ‘Closed’" once processing is complete.
• Prepare for Next Stage: Users are informed that "during the next stage, you will be able to document the response process and outcomes, and generate the final report."
• Document Details: Users are required to "describe the analysis details thoroughly in the text-area below for reporting purposes." A text editor is provided to input detailed notes, with formatting options such as bold, italic, underline, alignment, lists, links, images, and emojis.

• Users document the final details of the case resolution in the text area.
• After documenting the details, users click the "Closed" button to officially close the case and proceed to the final step in the Case Management process.

• Summarize Lessons Learned: Users are instructed to "summarize lessons learned from the response process and strengthen future security measures to better handle similar threats."
• Generate Final Report: Users are advised to "document the response and outcomes, click the ‘Generate Report’ button below and complete the final report."
• Document Details: Users are required to "describe the analysis details thoroughly in the text-area below for reporting purposes." A text editor is provided to input detailed notes, with formatting options such as bold, italic, underline, alignment, lists, links, images, and emojis.

• Users document the lessons learned and post-incident analysis in the text area.
• After documenting the details, users click the "Generate Report" button to compile the final report, concluding the Case Management process.

• Title: A text field to enter a custom title for the alert subscription.
  • Type: Checkboxes to select the type of notifications:
  • Notify on case opening: Sends an alert when a new case is created.
  • Notify on case progress: Sends an alert when a case’s status is updated.
• Severity Level: Radio buttons to select the severity level of cases to be notified about.

• Assignee: Displays a list of users assigned to receive alerts, including:
  • Name: The assignee’s name (e.g., Bryan Ga, Timo Choi, Jay Cho, Leonardo DiCaprio).
  • Assigned Role: The role of the assignee (e.g., Administrator, Customer, Engineer).
  • Email Address: The assignee’s email (e.g., markov01@markov.com).
  • Actions: Options to "Change Assignee" (reassign to another user) or "Remove Entry" (delete the assignee from the list).
• Recipient: Displays a list of additional recipients for alerts, with similar details and actions as the Assignee section.
• Add to Entry: A button to add new assignees or recipients to the subscription list.

• Additional fields can be defined by users. 

• Description: Displays real-time network traffic data over a selected time period (e.g., last 24 hours). The graph shows RX (receive) and TX (transmit) traffic in Mbps, with peaks and trends.

• Description: Shows a summary of the status sites.

• Description: Displays the top 5 sites ranked by network traffic

• Select Country & Region:
  • Country: A dropdown menu to select a country (e.g., South Korea, USA, China, Germany, Japan).
  • Region: A dropdown menu to select a region within the chosen country (e.g., USA > California).
• Site List:
  • After applying the country and region filters, a list of sites within the selected area is displayed.
  • The list includes columns such as:
    • Site: Name of the site (e.g., Head Office, New York Branch).
    • RX/TX (Mbps): Network traffic data for receive (RX) and transmit (TX) in Mbps.
    • Critical Cases: Number of critical cases associated with the site.
    • All Cases: Total number of cases for the site.

• Report Title: Indicates the main subject or focus of the report, providing a clear identifier for the incident or analysis.
• Report ID: A unique identifier assigned to the report for tracking and reference purposes within the system.
• Reported By: Identifies the user who generated the report, including their contact information for accountability and follow-up.
• Report Date: Specifies the date and time when the report was finalized, helping to establish a timeline for the incident response.
• Analysis Period: Defines the time range during which the incident was analyzed, providing context for the duration of the event and response efforts.
• Distribution Target: Lists the individuals, teams, or roles to whom the report is distributed, ensuring relevant stakeholders are informed.
• Summary: Offers a high-level overview of the incident, including key findings, the nature of the threat, and its impact, to provide a quick understanding of the situation.
• Related Elements: Presents statistical data in visual form (e.g., pie charts) to show the distribution of events by severity and the types of assets affected, aiding in understanding the scope and impact of the incident.